# CVE-2026-126991: MISP misp-modules Wikidata SPARQL injection

Source: https://junglewise.ai/threats/cve-2026-126991-the-wikidata-lookup-expansion-module-wiki-py-in-misp-misp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-126991 · Severity: info · Published 2026-11-12

MISP is a threat intelligence platform that uses modules to enrich security data from external sources. The Wikidata lookup module constructs queries to the Wikidata service by directly concatenating user input without escaping, allowing an authenticated attacker to inject SPARQL commands. This could expose data from the Wikidata service or leak sensitive information such as credentials through error messages.

Technologies: [Misp-Modules](https://junglewise.ai/threats/technologies/misp-misp-modules). Vendors: [Misp](https://junglewise.ai/threats/vendors/misp).

## Quick answers

**Is CVE-2026-126991 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126991 being exploited in the wild.

**How severe is CVE-2026-126991?** Informational severity, published 12 November 2026.

**Which products and versions are affected?** MISP misp-modules.

**Is there a fix for CVE-2026-126991?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-126991 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126991?** Check whether you run Misp-Modules. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The wiki.py module in misp-modules contains a SPARQL injection vulnerability where user-supplied text values are directly concatenated into SELECT queries without parameterization or escaping. An authenticated MISP user can supply crafted SPARQL syntax (quotes, braces, UNION, SERVICE, LIMIT) to alter query logic or extract unintended data. Additionally, error handling formats raw exception objects into responses, potentially leaking proxy credentials, query contents, or response bodies.

## Affected products

- MISP misp-modules

## Timeline

- 2026-11-12: disclosed

## References

- [https://github.com/MISP/misp-modules](https://github.com/MISP/misp-modules)
- [https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9](https://github.com/MISP/misp-modules/commit/7a2a7e3d9e0f67f6732bd8050ab7da79e7b344d9)

## Related threats

- [MISP Modules authorization bypass in external tools management](https://junglewise.ai/threats/cve-2026-127016-the-misp-modules-website-component-exposes-external-tool)
- [MISP Modules sourcecache SSRF in URL validation](https://junglewise.ai/threats/cve-2026-125871-the-sourcecache-expansion-module-in-misp-modules-misp-modules)
- [misp-modules cisco_firesight_manager_ACL_rule_export shell injection](https://junglewise.ai/threats/cve-2026-97863-the-cisco-firesight-manager-acl-rule-export-module-in-misp)